> However it makes even me nerveous to use a banking application or similar on an Android. Can’t imagine what kind of shit my dad would have running on an Android device with all the fake fishing apps, bloatware, tracking etc going around.

Do these people not do banking on Windows machines? The malware situation was infinitely worse on Windows - I see an Android device with some unwanted ads maybe once a year from a friend or family member, but Windows devices are a weekly occurrence and the really nasty stuff - like password sealers and banking trojans do exist, but are extremely hard to come by on Android, compared to Windows where clicking a pop-up and a run button could leave you permanently infested.

For me anyway, they certainly don't. iOS is the only computer platform my parents have ever been able to use well, and for that they adore it. Anecdotally I've heard similar from many friends.

> Do these people not do banking on Windows machines?

They don't.

Almost everyone I know does banking exclusively on their phones. I do that too.

I have an Android phone, but I would never use it (or an iPhone for that matter) to log into my bank account.

I recently got a free Android phone, and would also never let it near anything that could extract money from me, and am conscious of the information it can disclose.

Sorry, legitimate Android app developers! I would like to pay you for the things you create, but your neighborhood is too sketchy for me to visit.

That's pretty ridiculous, we're talking about credit card purchases here, which can be trivially charged back, not bitcoin private keys... if you've worked with sensitive info on a Windows box though, that's probably a much worse off environment.

The comment above didn't mention what type of card they are using nor in what country they live. Regarding Windows, in the times of Windows XP there were no "telemetry".

Using a smartphone for banking is really dangerous because banks often use a phone as a second factor and compromising the phone gives full access to your bank account. And many phones do not get security updates.

I'm not referring to Windows as poor for telemetry, but it's tremendously easier to get malware that takes over your whole system on Windows than any other platform - consider the fact that downloading and running unsigned executables is an extremely common practice - even as a fairly security conscious person I do it regularly on Windows. Add to that the fact that Windows completely lacks sandboxing and you pretty much get a pile of malware on your machine unless you really know what you're doing - and even then I've seen fairly technical people click next past a "bonus ask.com toolbar" in an installer.

Even with a regular bank account in most of the world at least, it's tightly regulated and you're only liable for a small portion of the loss - on a credit card, generally nothing at all.

Even without OS security updates, generally browsers and other internet connected software gets security updates regularly, I'd trust a new user on Android far more than Windows because clicking an ad would not have a risk of getting them infected system wide without jumping through some serious hoops and involving a few exploits. On Windows that's one Run button press away.

Is there a reason to believe that mobile ecosystem is more unsafe than the desktop ecosystem?

I would argue it the other way round. On mobile (Android or iOS), apps have much fewer permissions compared to on desktop. e.g., one app can't look into the data of the other app. On desktop, it is possible to write a binary which steals user cookies (e.g., https://github.com/rash2kool/cookie_stealer). For all purposes, the binary would be legitimate, and no antivirus or OS APIs would mark the binary as bad.

However, on mobile, one app can't peek into the private data of the other app. So, the Uber app can't peek into my browser cookies.

I think using a smartphone for banking is very dangerous:

- banks often use phone (for example, SMS) as a second factor for authentication, for example to confirm transactions. Compromising a phone thereforer provides full access to your account. Some banks even allow to perform payments by sending SMS without logging in.

- many phones do not receive security updates in time. And those updates close only public vulnerabilities.

- while Android has good permission system, many apps have a very wide set of permissions, including permission to read or send SMS messages, or permission to use accessibility functions, so compromising such an app can also be enough.

> With a non jailbroken iPhone I have a lot more peace of mind.

Ignorance is bliss.

You seem to have something to share, could you elaborate?

From my point of view, the sandboxing and authorization model of iOS is way better than what is available on Android right now.

You could argue that newer versions of Android provide a way to ask for permissions, but suffices to target API level 22 on your app and you're off of it. And fon't get me started on full disk encryption and buggy TPM implementations on Android.

So.. what do you know that we don't?

As far as I know, the "jailbreak" is performed by using closed-source software that often is heavily obfuscated to prevent analysis. You cannot be sure that it doesn't install a backdoor as a bonus.